CVE-2024-34110 Overview
CVE-2024-34110 affects Adobe Commerce and Magento Open Source with an Unrestricted Upload of File with Dangerous Type vulnerability [CWE-434]. A high-privilege attacker can upload a malicious file to the system, which the server can then execute as arbitrary code. Exploitation does not require user interaction. Affected releases include Adobe Commerce 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8, and earlier versions. Adobe addressed the issue in the Adobe Security Advisory APSB24-40 published in June 2024.
Critical Impact
An authenticated administrator can achieve arbitrary code execution on the underlying web server, compromising confidentiality, integrity, and availability of the storefront and backend data.
Affected Products
- Adobe Commerce 2.4.4 through 2.4.4-p8, 2.4.5 through 2.4.5-p7, 2.4.6 through 2.4.6-p5, and 2.4.7
- Adobe Commerce Webhooks module
- Magento Open Source (equivalent versions in the 2.4.x branch)
Discovery Timeline
- 2024-06-13 - CVE-2024-34110 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-34110
Vulnerability Analysis
The vulnerability stems from insufficient validation of file type and content on an administrative upload path in Adobe Commerce. The application accepts a file without adequately restricting its MIME type, extension, or content signature. An attacker with high-privilege access places a file with a dangerous type into a location where the web server can subsequently execute it. Once executed, the file runs with the privileges of the PHP process, granting the attacker code execution against the storefront backend.
Successful exploitation results in complete compromise of the Adobe Commerce instance. This includes theft of customer data, modification of product catalogs, injection of payment card skimmers, and lateral movement into supporting infrastructure.
Root Cause
The root cause is an Unrestricted Upload of File with Dangerous Type weakness [CWE-434]. The upload handler fails to enforce a strict allowlist of permitted file types or to sanitize file content before storing the file in a web-accessible directory. This allows attacker-controlled bytes to be interpreted as executable server-side code.
Attack Vector
The attack is network-reachable and requires an authenticated session with high privileges, typically an administrator account or an account with equivalent permission to invoke the vulnerable upload functionality. No user interaction is required. An attacker who has obtained administrator credentials through phishing, credential stuffing, or a prior compromise uploads a malicious payload and triggers its execution through a direct request to the stored file. Full technical details are described in prose only; no verified proof-of-concept code is publicly available for this issue.
Detection Methods for CVE-2024-34110
Indicators of Compromise
- Newly created files with executable extensions such as .php, .phtml, or .php7 inside pub/media/, var/, or other writable Magento directories.
- Web server access log entries showing POST requests to administrative upload endpoints followed by GET requests to unusual file paths under pub/media/.
- Unexpected outbound network connections initiated by the PHP-FPM or Apache worker process shortly after an admin session activity.
- New or modified admin user accounts, especially those created immediately before file upload activity.
Detection Strategies
- Monitor for creation of files with server-executable extensions in directories writable by the web application.
- Correlate admin authentication events with subsequent file writes and process launches under the web server user.
- Inspect uploaded file content against declared MIME type to identify polyglot files or embedded PHP within images.
- Alert on process execution chains where php-fpm or Apache spawns shells, curl, wget, or system utilities such as whoami.
Monitoring Recommendations
- Enable file integrity monitoring on the Magento webroot, focusing on app/, pub/, var/, and vendor directories.
- Forward web server, application, and admin audit logs to a centralized analytics platform for long-term retention and cross-source correlation.
- Track administrator login sources and flag logins from new geographies, hosting providers, or Tor exit nodes.
How to Mitigate CVE-2024-34110
Immediate Actions Required
- Apply the Adobe security update referenced in Adobe Security Advisory APSB24-40 to all Commerce and Magento Open Source instances.
- Rotate credentials for all administrative accounts and audit the admin user table for unauthorized additions.
- Review web-accessible directories for unexpected files and remove any unauthorized uploads.
- Restrict administrator panel access to trusted IP ranges or place it behind a VPN.
Patch Information
Adobe released fixes on June 11, 2024 in the following minimum versions: Adobe Commerce 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, and 2.4.4-p9, along with corresponding Magento Open Source builds. Refer to Adobe Security Advisory APSB24-40 for the complete list of fixed releases and download links.
Workarounds
- Enforce multi-factor authentication on all administrator accounts to reduce the risk of privileged account compromise.
- Configure the web server to prevent execution of PHP files inside upload directories such as pub/media/ using directives like php_flag engine off or Nginx location rules that deny script execution.
- Deploy a web application firewall rule set that blocks uploads containing PHP tags or executable magic bytes disguised as images.
- Remove administrator privileges from accounts that do not strictly require them to reduce the attack surface for this class of vulnerability.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
